KelpDAO Hacker Swaps 75,700 ETH for BTC In 36 Hours Through THORChain

TLDR

• KelpDAO hacker moved 75,700 ETH worth about $175 million into BTC in 36 hours.
• Most swaps were routed through THORChain, according to shared on-chain activity.
• The transactions generated about $800 million in total protocol volume.
• THORChain earned roughly $910,000 in fees from the cross-chain swaps.
• The asset shift moved stolen funds from Ethereum into Bitcoin in a short window.

KelpDAO hacker converts $175 million in ETH to BTC in 36 hours, and the funds moved fast. According to shared on-chain data, the attacker swapped nearly all 75,700 ETH into Bitcoin within about a day and a half. Most transfers were routed through THORChain, which enabled direct cross-chain swaps without a central platform.

KelpDAO hacker moves stolen ETH into Bitcoin

The latest movement came days after the reported KelpDAO rsETH exploit. On-chain trackers said the attacker held about 75,700 ETH. That stash was worth about $175 million during the swaps. Then the wallet activity changed quickly.

The attacker converted almost all of that ETH into BTC. The shift happened in about 36 hours, based on the shared timeline. That pace drew fresh attention from traders and investigators. It also changed how the market viewed the stolen funds.

A post from Wu Blockchain helped spread the update on April 23, 2026. The post said the hacker swapped nearly all of its ETH into BTC. It also said THORChain handled most of the activity. The claims matched the broader on-chain discussion.

The move matters because the funds did not stay on Ethereum. Instead, the attacker changed both the asset and the network path. That can make tracking harder across chains. It also creates new pressure for recovery efforts.

THORChain handles the bulk of the swap activity

THORChain played a central role in the reported transfers. The protocol allows users to swap assets across chains without a middleman. In this case, that meant direct ETH-to-BTC swaps. The attacker did not need a central exchange account.

That structure made the route faster and more flexible. It also meant the protocol processed the activity as normal user flow. As one common view puts it, “permissionless protocols do not ask where the money came from.” That point returned to debate after the swaps.

The size of the transfers was unusually large. Reports tied the swaps to about $800 million in total volume. That figure was much higher than the stolen amount because the route involved multiple transactions. Large cross-chain flows can expand gross volume quickly.

THORChain also collected notable fees during the same period. Shared figures put protocol fee revenue at roughly $910,000. That raised fresh questions about how open systems handle tainted funds. Still, the protocol itself continued to process trades.

Tracking efforts face a new phase after the asset change

The conversion into Bitcoin shifts the next stage of the case. Ethereum-based tracking had already mapped the stolen funds after the exploit. Now those funds sit in another major asset. That change can slow simple wallet tracing.

Even so, the movement was not hidden from public view. Observers followed the transfers in near real time through on-chain tools. That visibility helped confirm the route and pace. It also gave the market a clear timeline.

For KelpDAO, the focus remains on the exploit and any possible recovery path. For investigators, the task now centers on following the BTC trail. For the wider market, the case shows how fast stolen crypto can move. It also shows how quickly cross-chain protocols can absorb that flow.

The story continues to develop as more data appears. At this stage, the clearest fact is the scale and speed of the swap. About $175 million in ETH became BTC in roughly 36 hours. And most of that route appears to have run through THORChain.

The post KelpDAO Hacker Swaps 75,700 ETH for BTC In 36 Hours Through THORChain appeared first on CoinCentral.